CVE-2022-40716 — Unchecked Return Value in Hashicorp Consul

CWE-252 — Unchecked Return Value7 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
0.4%
top 41.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Github.com Hashicorp ConsulHashicorp ConsulDebian Consul
Timeline
PublishedSep 23
Latest updateAug 21

Description

HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13.2."

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶NVDhashicorp/consul1.12.0 — 1.12.5+2
▶Gogithub.com/hashicorp_consul1.12.0 — 1.12.5+2
▶debiandebian/consul

🔴Vulnerability Details

4
OSV
HashiCorp Consul vulnerable to authorization bypass in github.com/hashicorp/consul↗2024-08-21
▶
OSV
HashiCorp Consul vulnerable to authorization bypass↗2022-09-25
▶
GHSA
HashiCorp Consul vulnerable to authorization bypass↗2022-09-25
▶
OSV
CVE-2022-40716: HashiCorp Consul and Consul Enterprise up to 1↗2022-09-23
▶

📋Vendor Advisories

2
Red Hat
consul: Consul Service Mesh Intention Bypass with Malicious Certificate Signing Request↗2022-09-23
▶
Debian
CVE-2022-40716: consul - HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not c...↗2022
▶